mirror of
https://github.com/HIllya51/LunaTranslator.git
synced 2024-12-26 23:24:13 +08:00
.
This commit is contained in:
恍兮惚兮
parent
07907b055b
commit
658bfd1723
@ -1,61 +0,0 @@
|
||||
|
||||
#include <detours.h>
|
||||
|
||||
struct LRProfile
|
||||
{
|
||||
UINT CodePage;
|
||||
UINT LCID;
|
||||
long Bias;
|
||||
int HookIME;
|
||||
int HookLCID;
|
||||
};
|
||||
int WrtieConfigFileMap(LRProfile *profile)
|
||||
{
|
||||
SetEnvironmentVariableW(L"LRCodePage", (LPCWSTR)&profile->CodePage);
|
||||
SetEnvironmentVariableW(L"LRLCID", (LPCWSTR)&profile->LCID);
|
||||
SetEnvironmentVariableW(L"LRBIAS", (LPCWSTR)&profile->Bias);
|
||||
SetEnvironmentVariableW(L"LRHookIME", (LPCWSTR)&profile->HookIME);
|
||||
SetEnvironmentVariableW(L"LRHookLCID", (LPCWSTR)&profile->HookLCID);
|
||||
return 0;
|
||||
}
|
||||
// https://github.com/InWILL/Locale_Remulator/blob/master/LRProc/LRProc.cpp
|
||||
int LRwmain(int argc, wchar_t *wargv[])
|
||||
{
|
||||
char current[2048];
|
||||
GetModuleFileNameA(NULL, current, 2048);
|
||||
std::string _s = current;
|
||||
_s = _s.substr(0, _s.find_last_of("\\"));
|
||||
auto dllpath = _s + "\\Locale_Remulator\\";
|
||||
auto targetexe = wargv[6];
|
||||
std::wstring cmd = L"";
|
||||
for (int i = 6; i < argc; i++)
|
||||
{
|
||||
cmd += L"\"";
|
||||
cmd += wargv[i];
|
||||
cmd += L"\" ";
|
||||
}
|
||||
DWORD type;
|
||||
GetBinaryTypeW(targetexe, &type);
|
||||
if (type == 6)
|
||||
dllpath += "LRHookx64.dll";
|
||||
else
|
||||
dllpath += "LRHookx32.dll";
|
||||
LRProfile beta;
|
||||
beta.CodePage = std::stoi(wargv[1]); // 932;
|
||||
beta.LCID = std::stoi(wargv[2]); // 0x0411;
|
||||
beta.Bias = std::stoi(wargv[3]); // 540; // Bias will become negative in HookGetTimeZoneInformation
|
||||
beta.HookIME = std::stoi(wargv[4]); // false;
|
||||
beta.HookLCID = std::stoi(wargv[5]); // true;
|
||||
|
||||
WrtieConfigFileMap(&beta);
|
||||
STARTUPINFOW si;
|
||||
PROCESS_INFORMATION pi;
|
||||
ZeroMemory(&si, sizeof(STARTUPINFO));
|
||||
ZeroMemory(&pi, sizeof(PROCESS_INFORMATION));
|
||||
si.cb = sizeof(STARTUPINFO);
|
||||
DetourCreateProcessWithDllExW(NULL, cmd.data(), NULL,
|
||||
NULL, FALSE, CREATE_DEFAULT_ERROR_MODE, NULL, NULL,
|
||||
&si, &pi, dllpath.c_str(), NULL);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@ -1,151 +0,0 @@
|
||||
|
||||
#define SHIFT_JIS 932
|
||||
namespace
|
||||
{
|
||||
int GetCharsetFromANSICodepage(int ansicp)
|
||||
{
|
||||
auto charset = ANSI_CHARSET;
|
||||
|
||||
switch (ansicp)
|
||||
{
|
||||
case 932: // Japanese
|
||||
charset = SHIFTJIS_CHARSET;
|
||||
break;
|
||||
case 936: // Simplified Chinese
|
||||
charset = GB2312_CHARSET;
|
||||
break;
|
||||
case 949: // Korean
|
||||
charset = HANGEUL_CHARSET;
|
||||
break;
|
||||
case 950: // Traditional Chinese
|
||||
charset = CHINESEBIG5_CHARSET;
|
||||
break;
|
||||
case 1250: // Eastern Europe
|
||||
charset = EASTEUROPE_CHARSET;
|
||||
break;
|
||||
case 1251: // Russian
|
||||
charset = RUSSIAN_CHARSET;
|
||||
break;
|
||||
case 1252: // Western European Languages
|
||||
charset = ANSI_CHARSET;
|
||||
break;
|
||||
case 1253: // Greek
|
||||
charset = GREEK_CHARSET;
|
||||
break;
|
||||
case 1254: // Turkish
|
||||
charset = TURKISH_CHARSET;
|
||||
break;
|
||||
case 1255: // Hebrew
|
||||
charset = HEBREW_CHARSET;
|
||||
break;
|
||||
case 1256: // Arabic
|
||||
charset = ARABIC_CHARSET;
|
||||
break;
|
||||
case 1257: // Baltic
|
||||
charset = BALTIC_CHARSET;
|
||||
break;
|
||||
}
|
||||
|
||||
return charset;
|
||||
}
|
||||
|
||||
// https://github.com/xupefei/Locale-Emulator-Core/blob/ae7160dc5deb97947396abcd784f9b98b6ee38b3/LocaleEmulator/LocaleEmulator.h#L131
|
||||
|
||||
typedef struct
|
||||
{
|
||||
USHORT Length;
|
||||
USHORT MaximumLength;
|
||||
union
|
||||
{
|
||||
PWSTR Buffer;
|
||||
ULONG64 Dummy;
|
||||
};
|
||||
|
||||
} UNICODE_STRING3264, *PUNICODE_STRING3264;
|
||||
|
||||
typedef UNICODE_STRING3264 UNICODE_STRING64;
|
||||
typedef PUNICODE_STRING3264 PUNICODE_STRING64;
|
||||
typedef struct
|
||||
{
|
||||
ULONG64 Root;
|
||||
UNICODE_STRING64 SubKey;
|
||||
UNICODE_STRING64 ValueName;
|
||||
ULONG DataType;
|
||||
PVOID64 Data;
|
||||
ULONG64 DataSize;
|
||||
|
||||
} REGISTRY_ENTRY64;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
REGISTRY_ENTRY64 Original;
|
||||
REGISTRY_ENTRY64 Redirected;
|
||||
|
||||
} REGISTRY_REDIRECTION_ENTRY64, *PREGISTRY_REDIRECTION_ENTRY64;
|
||||
typedef struct
|
||||
{
|
||||
ULONG AnsiCodePage;
|
||||
ULONG OemCodePage;
|
||||
ULONG LocaleID;
|
||||
ULONG DefaultCharset;
|
||||
ULONG HookUILanguageApi;
|
||||
WCHAR DefaultFaceName[LF_FACESIZE];
|
||||
TIME_ZONE_INFORMATION Timezone;
|
||||
ULONG64 NumberOfRegistryRedirectionEntries;
|
||||
REGISTRY_REDIRECTION_ENTRY64 RegistryReplacement[1];
|
||||
|
||||
} LOCALE_ENUMLATOR_ENVIRONMENT_BLOCK, *PLOCALE_ENUMLATOR_ENVIRONMENT_BLOCK, LEB, *PLEB;
|
||||
|
||||
}
|
||||
int lewmain(int argc, wchar_t *argv[])
|
||||
{
|
||||
/*
|
||||
argv[0] le
|
||||
argv[1] ANSICodePage
|
||||
argv[2] OEMCodePage
|
||||
argv[3] LCID
|
||||
argv[4] dirname
|
||||
argv[5] RedirectRegistry
|
||||
argv[6] HookUILanguageAPI
|
||||
argvx exe
|
||||
... args
|
||||
*/
|
||||
#define exeargi 7
|
||||
std::wstring cmd = L"";
|
||||
for (int i = exeargi; i < argc; i++)
|
||||
{
|
||||
cmd += L"\"";
|
||||
cmd += argv[i];
|
||||
cmd += L"\" ";
|
||||
}
|
||||
std::wstring process = argv[exeargi];
|
||||
auto ANSICodePage = std::stoi(argv[1]);//932 SHIFT_JIS
|
||||
auto OEMCodePage = std::stoi(argv[2]);//932 SHIFT_JIS
|
||||
auto LCID = std::stoi(argv[3]);//0x11 LANG_JAPANESE
|
||||
auto dirname = argv[4];
|
||||
auto RedirectRegistry = std::stoi(argv[5]);
|
||||
auto HookUILanguageAPI = std::stoi(argv[6]);
|
||||
|
||||
PROCESS_INFORMATION info = {};
|
||||
if (HMODULE localeEmulator = LoadLibraryW(L".\\LoaderDll"))
|
||||
{
|
||||
|
||||
LEB _leb;
|
||||
ZeroMemory(&_leb, sizeof(LEB));
|
||||
_leb.AnsiCodePage = ANSICodePage;
|
||||
_leb.OemCodePage = OEMCodePage;
|
||||
_leb.LocaleID = LCID;
|
||||
_leb.DefaultCharset = GetCharsetFromANSICodepage(ANSICodePage);
|
||||
_leb.HookUILanguageApi = HookUILanguageAPI;
|
||||
GetTimeZoneInformation(&_leb.Timezone);
|
||||
auto ret = ((LONG(__stdcall *)(LEB *, LPCWSTR appName, LPWSTR commandLine, LPCWSTR currentDir, void *, void *, PROCESS_INFORMATION *, void *, void *, void *, void *))
|
||||
GetProcAddress(localeEmulator, "LeCreateProcess"))(&_leb, process.c_str(), cmd.data(), dirname, NULL, NULL, &info, NULL, NULL, NULL, NULL);
|
||||
if (ret == 0)
|
||||
{
|
||||
WaitForSingleObject(info.hProcess, INFINITE);
|
||||
CloseHandle(info.hProcess);
|
||||
CloseHandle(info.hThread);
|
||||
}
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
@ -1,685 +0,0 @@
|
||||
|
||||
#define NTLEA_PARAMETERS_LENGTH (LF_FACESIZE + 20)
|
||||
|
||||
#define szRcpIntMtx "RcpInternalMutex"
|
||||
#define szTranslation "\\VarFileInfo\\Translation"
|
||||
#define szRcpEvent "RcpEvent000"
|
||||
#define szRcpFileMap "RcpFileMap000"
|
||||
#define szRshFileMap "RshFileMap000"
|
||||
#define szCaption "NT Locale Emulator Advance"
|
||||
|
||||
#if defined(_AMD64_)
|
||||
#define RegIP Rip
|
||||
#define IMAGE_FILE_MACHINE_VALID IMAGE_FILE_MACHINE_AMD64
|
||||
#define IMAGE_FILE_MACHINE_INVALID IMAGE_FILE_MACHINE_I386
|
||||
#define IMAGE_FILE_MACHINE_ESTRING L"x86"
|
||||
#define WM_CLASSMASK 0xFFFFFFFF00000000
|
||||
#elif defined(_X86_)
|
||||
#define RegIP Eip
|
||||
#define IMAGE_FILE_MACHINE_VALID IMAGE_FILE_MACHINE_I386
|
||||
#define IMAGE_FILE_MACHINE_INVALID IMAGE_FILE_MACHINE_AMD64
|
||||
#define IMAGE_FILE_MACHINE_ESTRING L"x64"
|
||||
#define WM_CLASSMASK 0xFFFF0000
|
||||
#endif
|
||||
|
||||
typedef enum
|
||||
{
|
||||
ERR_UKNOWN = -10000,
|
||||
ERR_PE_FORMAT_INVALID = -10001,
|
||||
ERR_MULTIPLE_INSTANCE = -10002,
|
||||
ERR_EXECUTABLE_MISSING = -10003,
|
||||
ERR_EXECUTABLE_INVALID = -10004,
|
||||
ERR_PROCESS_CREATE_FAILED = -10005,
|
||||
ERR_NTLEA_DLL_MISSING = -10006,
|
||||
ERR_FAILED_ALLOCATE_MEM = -10007,
|
||||
ERR_HOOKPROCESS_MISSING = -10008,
|
||||
ERR_FAILED_QUERY_PROCESS = -10009,
|
||||
ERR_FAILED_READFILEINFO = -10010,
|
||||
ERR_UNKNOWN_FORMAT_INVALID = -10011,
|
||||
// -----
|
||||
ERR_REDIRECTED_PLATFORM = 10001,
|
||||
} NtleaErrorNo;
|
||||
|
||||
typedef struct
|
||||
{
|
||||
// -------------- inputparam
|
||||
DWORD dwCompOption;
|
||||
DWORD dwCodePage;
|
||||
DWORD dwLCID;
|
||||
DWORD dwTimeZone;
|
||||
DWORD dwSpApp;
|
||||
BYTE FontFaceName[LF_FACESIZE];
|
||||
// -------------- internal
|
||||
HANDLE RcpEvent, RcpFileMap; // HANDLE
|
||||
LPVOID FileMappingAddress, ImageBase, EntryPoint; // LPVOID
|
||||
HMODULE hInstance;
|
||||
// ...
|
||||
} NtleaProcess;
|
||||
|
||||
#if defined(_AMD64_)
|
||||
static WCHAR rcpHookDll[] = L"ntleak.dll"; // default use ...
|
||||
#elif defined(_X86_)
|
||||
static WCHAR rcpHookDll[] = L"ntleai.dll"; // default use ...
|
||||
#endif
|
||||
extern LPCWSTR szRcpHookDLL = rcpHookDll;
|
||||
|
||||
NtleaErrorNo PrintErrorString(NtleaErrorNo errnum);
|
||||
|
||||
#include <Windows.h>
|
||||
#include <Psapi.h>
|
||||
|
||||
void ParseFileMapParams(NtleaProcess *process)
|
||||
{
|
||||
HANDLE hRshFileMap = CreateFileMappingA(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, 0, NTLEA_PARAMETERS_LENGTH, szRshFileMap);
|
||||
if (GetLastError())
|
||||
{ // mapping not found
|
||||
LPVOID hView = MapViewOfFile(hRshFileMap, FILE_MAP_ALL_ACCESS, 0, 0, NTLEA_PARAMETERS_LENGTH);
|
||||
process->dwCompOption = *((LPDWORD)hView + 0);
|
||||
process->dwCodePage = *((LPDWORD)hView + 1);
|
||||
process->dwLCID = *((LPDWORD)hView + 2);
|
||||
process->dwTimeZone = *((LPDWORD)hView + 3);
|
||||
process->dwSpApp = *((LPDWORD)hView + 4);
|
||||
lstrcpyA((char *)process->FontFaceName, (char const *)hView + 20);
|
||||
}
|
||||
else
|
||||
{ // 20 BYTES
|
||||
process->dwCompOption = 0;
|
||||
process->dwCodePage = 932;
|
||||
process->dwLCID = 0x411;
|
||||
process->dwTimeZone = (DWORD)-540;
|
||||
process->dwSpApp = 100; // ntlea use this value /100 for font-ratio !
|
||||
*(LPDWORD)process->FontFaceName = 0; // copy empty
|
||||
}
|
||||
CloseHandle(hRshFileMap);
|
||||
}
|
||||
|
||||
int CreateFileMapInf(NtleaProcess *process, HANDLE hexecute, LPBYTE FileBuffer)
|
||||
{
|
||||
DWORD dwread;
|
||||
if (ReadFile(hexecute, FileBuffer, 1024, &dwread, NULL) && (*(WORD *)FileBuffer == 0x5A4D))
|
||||
{
|
||||
CloseHandle(hexecute);
|
||||
// now parse the entrypoint :
|
||||
IMAGE_DOS_HEADER *pdoshead = (IMAGE_DOS_HEADER *)(FileBuffer);
|
||||
IMAGE_NT_HEADERS *pntheads = (IMAGE_NT_HEADERS *)(FileBuffer + pdoshead->e_lfanew);
|
||||
// check x86 or x64 or ... ???
|
||||
if (pntheads->FileHeader.Machine == IMAGE_FILE_MACHINE_VALID ||
|
||||
pntheads->FileHeader.Machine == IMAGE_FILE_MACHINE_INVALID)
|
||||
{
|
||||
// calc the entry point ??
|
||||
process->ImageBase = (LPVOID)(DWORD_PTR)(pntheads->OptionalHeader.ImageBase);
|
||||
process->EntryPoint = (LPVOID)(DWORD_PTR)(pntheads->OptionalHeader.AddressOfEntryPoint);
|
||||
// build event & filemapping :
|
||||
process->RcpEvent = CreateEventA(NULL, FALSE, FALSE, szRcpEvent);
|
||||
process->RcpFileMap = CreateFileMappingA(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, 0, sizeof(LPVOID), szRcpFileMap);
|
||||
process->FileMappingAddress = MapViewOfFile(process->RcpFileMap, FILE_MAP_ALL_ACCESS, 0, 0, sizeof(LPVOID));
|
||||
// return continue flag or not :
|
||||
return (pntheads->FileHeader.Machine == IMAGE_FILE_MACHINE_VALID) ? (0) : (ERR_PE_FORMAT_INVALID);
|
||||
}
|
||||
else
|
||||
{
|
||||
return (ERR_UNKNOWN_FORMAT_INVALID);
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
return (ERR_FAILED_READFILEINFO);
|
||||
}
|
||||
}
|
||||
|
||||
int DeleteFileMapping(NtleaProcess *process)
|
||||
{
|
||||
if (process->FileMappingAddress)
|
||||
UnmapViewOfFile(process->FileMappingAddress);
|
||||
if (process->RcpFileMap)
|
||||
CloseHandle(process->RcpFileMap);
|
||||
if (process->RcpEvent)
|
||||
CloseHandle(process->RcpEvent);
|
||||
return (0);
|
||||
}
|
||||
|
||||
// --------------------------------
|
||||
|
||||
int CreateProcessStartW(NtleaProcess *process, wchar_t const *applicationPath)
|
||||
{
|
||||
DWORD bintype;
|
||||
HANDLE hexecute;
|
||||
BYTE FileBuffer[1024];
|
||||
if (GetBinaryTypeW(applicationPath, &bintype))
|
||||
{
|
||||
hexecute = CreateFileW(applicationPath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
|
||||
if (hexecute == INVALID_HANDLE_VALUE)
|
||||
{
|
||||
return ERR_EXECUTABLE_MISSING; // exit !!
|
||||
}
|
||||
else
|
||||
{
|
||||
return CreateFileMapInf(process, hexecute, FileBuffer);
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
return ERR_EXECUTABLE_INVALID; // exit !!
|
||||
}
|
||||
}
|
||||
|
||||
int CreateProcessBeginW(NtleaProcess *process, wchar_t const *applicationPath)
|
||||
{
|
||||
// ParseFileMapParams(process);
|
||||
return CreateProcessStartW(process, applicationPath);
|
||||
}
|
||||
// first see MSDN : http://msdn.microsoft.com/en-us/library/windows/desktop/ms684280(v=vs.85).aspx
|
||||
// read process address, see also : http://www.cnblogs.com/jeJee/archive/2013/03/08/2950345.html
|
||||
// for more info, see : http://stackoverflow.com/questions/8447801/getting-a-module-handle-from-other-process
|
||||
// and : http://stackoverflow.com/questions/8336214/how-can-i-get-a-process-entry-point-address
|
||||
typedef struct
|
||||
{
|
||||
DWORD_PTR ExitStatus;
|
||||
DWORD_PTR PebBaseAddress;
|
||||
DWORD_PTR AffinityMask;
|
||||
DWORD_PTR BasePriority;
|
||||
ULONG_PTR UniqueProcessId;
|
||||
ULONG_PTR InheritedFromUniqueProcessId;
|
||||
} PROCESS_BASIC_INFORMATION;
|
||||
|
||||
typedef enum
|
||||
{
|
||||
ProcessBasicInformation = 0,
|
||||
ProcessDebugPort = 7,
|
||||
ProcessWow64Information = 26,
|
||||
ProcessImageFileName = 27,
|
||||
ProcessBreakOnTermination = 28,
|
||||
} PROCESSINFOCLASS;
|
||||
|
||||
int ResetBaseAddress(NtleaProcess *process, PROCESS_INFORMATION const *proinfo)
|
||||
{
|
||||
PROCESS_BASIC_INFORMATION pbi;
|
||||
SIZE_T bytesRead;
|
||||
DWORD_PTR baseAddr;
|
||||
// -------------------------------
|
||||
typedef NTSTATUS(WINAPI * PROCNTQSIP)(HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG);
|
||||
PROCNTQSIP NtQueryInformationProcess = (PROCNTQSIP)GetProcAddress(GetModuleHandleA("ntdll"), "NtQueryInformationProcess");
|
||||
if (!NtQueryInformationProcess)
|
||||
{
|
||||
return ERR_FAILED_QUERY_PROCESS;
|
||||
}
|
||||
// Retrieve information :
|
||||
NTSTATUS ret = NtQueryInformationProcess(proinfo->hProcess, ProcessBasicInformation, (PVOID)&pbi, sizeof(PROCESS_BASIC_INFORMATION), NULL);
|
||||
fprintf(stderr, "QueryProcess info pointer : %p, ret : %d\n", NtQueryInformationProcess, ret);
|
||||
if (ret >= 0)
|
||||
{
|
||||
ReadProcessMemory(proinfo->hProcess, (PVOID)(pbi.PebBaseAddress + 2 * sizeof(PVOID)), &baseAddr, sizeof(baseAddr), &bytesRead);
|
||||
process->EntryPoint = (LPBYTE)process->EntryPoint + baseAddr;
|
||||
fprintf(stderr, "ProcessID : %u, EntryPoint_1 : %p\n", proinfo->dwProcessId, process->EntryPoint);
|
||||
}
|
||||
else
|
||||
{
|
||||
process->EntryPoint = (LPBYTE)process->EntryPoint + (DWORD_PTR)process->ImageBase;
|
||||
fprintf(stderr, "ProcessID : %u, EntryPoint_0 : %p\n", proinfo->dwProcessId, process->EntryPoint);
|
||||
}
|
||||
return (0);
|
||||
}
|
||||
|
||||
int ResetWorkingDirectory(HANDLE hprocess)
|
||||
{
|
||||
WCHAR exepath[MAX_PATH * 2];
|
||||
DWORD len = ARRAYSIZE(exepath); // i think it should be enough ??
|
||||
#if 1
|
||||
BOOL(WINAPI * pfnQueryFullProcessImageName)
|
||||
(HANDLE, DWORD, LPWSTR, PDWORD);
|
||||
pfnQueryFullProcessImageName = (BOOL(WINAPI *)(HANDLE, DWORD, LPWSTR, PDWORD))
|
||||
GetProcAddress(LoadLibraryW(L"kernel32.dll"), "QueryFullProcessImageNameW");
|
||||
// ----------------------------- XP won't support this, but just skip that's ok
|
||||
if (pfnQueryFullProcessImageName && pfnQueryFullProcessImageName(hprocess, 0, exepath, &len))
|
||||
#else
|
||||
DWORD(WINAPI * pfnGetModuleFileNameEx)
|
||||
(HANDLE hProcess, HMODULE hModule, LPWSTR lpFilename, DWORD nSize);
|
||||
HMODULE hModuleLib = LoadLibraryW(L"psapi.dll");
|
||||
pfnGetModuleFileNameEx = (DWORD(WINAPI *)(HANDLE, HMODULE, LPWSTR, DWORD))GetProcAddress(hModuleLib, "GetModuleFileNameExW");
|
||||
len = pfnGetModuleFileNameEx(hProcess, NULL, exepath, len);
|
||||
FreeLibrary(hModuleLib);
|
||||
// -----------------------------
|
||||
if (len > 0)
|
||||
#endif
|
||||
{
|
||||
LPCWSTR p = len + exepath;
|
||||
while (p > exepath && *p != L'\\')
|
||||
--p;
|
||||
if (*p == L'\\')
|
||||
{
|
||||
exepath[p - exepath] = L'\0'; // make as tail
|
||||
SetCurrentDirectoryW(exepath);
|
||||
fprintf(stderr, "set current working directory to %S\n", exepath);
|
||||
}
|
||||
}
|
||||
return (0);
|
||||
}
|
||||
|
||||
int InjectProcessDLL(NtleaProcess const *process, PROCESS_INFORMATION const *proinfo)
|
||||
{
|
||||
// ParameterExists : CurrentDir with PathLength + szRcpHookDLL, then : FontFaceName with strlen, 4 * DWORD
|
||||
WCHAR CurrentDir[MAX_PATH + (NTLEA_PARAMETERS_LENGTH / 2)];
|
||||
// Search Directories :
|
||||
|
||||
GetModuleFileNameW(NULL, CurrentDir, 2048);
|
||||
std::wstring _s = CurrentDir;
|
||||
_s = _s.substr(0, _s.find_last_of(L"\\"));
|
||||
auto dllpath = _s + L"\\NTLEAS\\";
|
||||
dllpath += szRcpHookDLL;
|
||||
lstrcpyW(CurrentDir, dllpath.c_str());
|
||||
|
||||
UINT PathLength = dllpath.size();
|
||||
|
||||
if (PathLength == 0)
|
||||
{
|
||||
return ERR_NTLEA_DLL_MISSING;
|
||||
} // can't find dll !
|
||||
// -----------------------
|
||||
LPBYTE p = (LPBYTE)(CurrentDir + lstrlenW(CurrentDir) + 1);
|
||||
lstrcpyA((LPSTR)p, (LPSTR)process->FontFaceName);
|
||||
p += lstrlenA((LPSTR)process->FontFaceName) + 1;
|
||||
*((LPDWORD)p) = process->dwCompOption;
|
||||
p += sizeof(DWORD);
|
||||
*((LPDWORD)p) = process->dwCodePage;
|
||||
p += sizeof(DWORD);
|
||||
*((LPDWORD)p) = process->dwLCID;
|
||||
p += sizeof(DWORD);
|
||||
*((LPDWORD)p) = process->dwTimeZone;
|
||||
p += sizeof(DWORD);
|
||||
// allocate memory for remote-process DLL parameters :
|
||||
DWORD length = (DWORD)(p - (LPBYTE)CurrentDir);
|
||||
LPVOID BaseAddress = VirtualAllocEx(proinfo->hProcess, NULL, length, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
|
||||
if (!BaseAddress)
|
||||
{
|
||||
return ERR_FAILED_ALLOCATE_MEM; // failed exit
|
||||
}
|
||||
*(LPVOID *)process->FileMappingAddress = BaseAddress; // required for other thread usage ??
|
||||
WriteProcessMemory(proinfo->hProcess, BaseAddress, CurrentDir, length, NULL);
|
||||
// why [ecx(LoadLibraryW) + 2] for LoadLibraryW in NTLEA ???
|
||||
HANDLE hRemoteThread;
|
||||
DWORD dwRemoteThreadId;
|
||||
hRemoteThread = CreateRemoteThread(proinfo->hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)LoadLibraryW, BaseAddress, 0, &dwRemoteThreadId);
|
||||
fprintf(stderr, "remote thread handle : 0x%p, threadid : %u\n", hRemoteThread, dwRemoteThreadId);
|
||||
CloseHandle(hRemoteThread);
|
||||
// -----------------------
|
||||
return (0);
|
||||
}
|
||||
|
||||
static void checkNtleaSignal(void)
|
||||
{
|
||||
HANDLE ntleasig = OpenEventW(EVENT_ALL_ACCESS, FALSE, L"ntleasig");
|
||||
if (ntleasig)
|
||||
{
|
||||
WaitForSingleObject(ntleasig, INFINITE);
|
||||
CloseHandle(ntleasig);
|
||||
}
|
||||
}
|
||||
|
||||
int CreateProcessEnd(NtleaProcess *process, PROCESS_INFORMATION const *proinfo, BOOL bSuspendFlag)
|
||||
{
|
||||
static BYTE const BreakPoint[] = {
|
||||
0xEB,
|
||||
0xFE,
|
||||
};
|
||||
BYTE instrcache[sizeof(BreakPoint)];
|
||||
int ret;
|
||||
|
||||
// just wait for the initial breakpoint :
|
||||
ret = ResetBaseAddress(process, proinfo);
|
||||
if (ret < 0)
|
||||
{
|
||||
fprintf(stderr, "failed rebase address ret = %d!\n", ret);
|
||||
return ret;
|
||||
}
|
||||
|
||||
// try to add an breakpoint at the entrypoint !
|
||||
ReadProcessMemory(proinfo->hProcess, process->EntryPoint, instrcache, sizeof(instrcache), NULL);
|
||||
WriteProcessMemory(proinfo->hProcess, process->EntryPoint, BreakPoint, sizeof(BreakPoint), NULL);
|
||||
FlushInstructionCache(proinfo->hProcess, process->EntryPoint, sizeof(instrcache));
|
||||
|
||||
// wait thread arrived their ??
|
||||
ResumeThread(proinfo->hThread);
|
||||
Sleep(32); // sleep shorter time
|
||||
SuspendThread(proinfo->hThread);
|
||||
while (proinfo->hThread == proinfo->hThread /*true*/)
|
||||
{ // Wow64GetThreadContext
|
||||
CONTEXT threadctx = {
|
||||
0,
|
||||
};
|
||||
// see : http://stackoverflow.com/questions/11396034/cant-get-thread-context-from-a-windows-64-bit-process
|
||||
// ContextFlags on x64 offset no longer at the very beginning !
|
||||
threadctx.ContextFlags = CONTEXT_CONTROL;
|
||||
if (!GetThreadContext(proinfo->hThread, &threadctx))
|
||||
{
|
||||
fprintf(stderr, "Failed GetThreadContext : %u\n", GetLastError());
|
||||
return ERR_HOOKPROCESS_MISSING;
|
||||
}
|
||||
ResumeThread(proinfo->hThread);
|
||||
Sleep(32); // sleep shorter time
|
||||
SuspendThread(proinfo->hThread);
|
||||
// AVC said that, x64 version of GetThreadContext may not require the correct value if different sys-bandwidth.
|
||||
if (threadctx.RegIP == (DWORD_PTR)process->EntryPoint)
|
||||
break; // X86 only
|
||||
}
|
||||
|
||||
if (!process->hInstance)
|
||||
{
|
||||
checkNtleaSignal();
|
||||
}
|
||||
|
||||
// inject DLL :
|
||||
ret = InjectProcessDLL(process, proinfo);
|
||||
if (ret < 0)
|
||||
{
|
||||
fprintf(stderr, "failed inject DLL ret = %d!\n", ret);
|
||||
return ret;
|
||||
}
|
||||
|
||||
// wait remote process hooking prepared :
|
||||
if (WAIT_OBJECT_0 == WaitForSingleObject(process->RcpEvent, 30 * 1000))
|
||||
{
|
||||
fprintf(stderr, "success wait signal!\n");
|
||||
}
|
||||
else
|
||||
{
|
||||
fprintf(stderr, "failed wait signal timeout!\n");
|
||||
}
|
||||
|
||||
if (!process->hInstance)
|
||||
{
|
||||
checkNtleaSignal();
|
||||
}
|
||||
|
||||
// free all resource :
|
||||
DeleteFileMapping(process);
|
||||
// put back the instruction :
|
||||
WriteProcessMemory(proinfo->hProcess, process->EntryPoint, instrcache, sizeof(instrcache), NULL);
|
||||
FlushInstructionCache(proinfo->hProcess, process->EntryPoint, sizeof(instrcache));
|
||||
|
||||
if (!bSuspendFlag)
|
||||
ResumeThread(proinfo->hThread);
|
||||
|
||||
return (0);
|
||||
}
|
||||
|
||||
int CreateProcessEndExt(NtleaProcess *process, PROCESS_INFORMATION const *proinfo, BOOL bSuspendFlag)
|
||||
{
|
||||
static BYTE const BreakPoint[] = {
|
||||
0xCC,
|
||||
0xCC,
|
||||
0xCC,
|
||||
0xCC,
|
||||
};
|
||||
BYTE instrcache[sizeof(BreakPoint)];
|
||||
DEBUG_EVENT dbgevent;
|
||||
int ret, fin = 0;
|
||||
void *dbgstrbuf = HeapAlloc(GetProcessHeap(), 0, 1024);
|
||||
|
||||
// just wait for the initial breakpoint :
|
||||
ret = ResetBaseAddress(process, proinfo);
|
||||
if (ret < 0)
|
||||
{
|
||||
fprintf(stderr, "failed rebase address ret = %d!\n", ret);
|
||||
return ret;
|
||||
}
|
||||
|
||||
// DebugActiveProcess(proinfo->dwProcessId);
|
||||
// just wait for the initial breakpoint :
|
||||
while (!fin)
|
||||
{
|
||||
ret = WaitForDebugEvent(&dbgevent, 25);
|
||||
if (ret)
|
||||
{
|
||||
switch (dbgevent.dwDebugEventCode)
|
||||
{
|
||||
case CREATE_PROCESS_DEBUG_EVENT:
|
||||
{ // prepare ! ParameterExists :
|
||||
fprintf(stderr, "proc start address %p vs calc address %p\n",
|
||||
(LPVOID)(DWORD_PTR)dbgevent.u.CreateProcessInfo.lpStartAddress, process->EntryPoint);
|
||||
// try to add an breakpoint at the entrypoint !
|
||||
ReadProcessMemory(proinfo->hProcess, process->EntryPoint, instrcache, sizeof(instrcache), NULL);
|
||||
WriteProcessMemory(proinfo->hProcess, process->EntryPoint, BreakPoint, sizeof(BreakPoint), NULL);
|
||||
// inject DLL :
|
||||
InjectProcessDLL(process, proinfo);
|
||||
// now continue ??
|
||||
ContinueDebugEvent(dbgevent.dwProcessId, dbgevent.dwThreadId, DBG_CONTINUE);
|
||||
}
|
||||
break;
|
||||
/* case CREATE_THREAD_DEBUG_EVENT:
|
||||
{
|
||||
CREATE_THREAD_DEBUG_INFO* dbginfo = &dbgevent.u.CreateThread;
|
||||
fprintf(stderr, "threadstartup baseaddr : 0x%p, handle : 0x%p, ID : %u\n", dbginfo->lpStartAddress, dbginfo->hThread, dbgevent.dwThreadId);
|
||||
ContinueDebugEvent(dbgevent.dwProcessId, dbgevent.dwThreadId, DBG_CONTINUE);
|
||||
} break;
|
||||
case EXIT_THREAD_DEBUG_EVENT:
|
||||
{
|
||||
EXIT_THREAD_DEBUG_INFO* dbginfo = &dbgevent.u.ExitThread;
|
||||
fprintf(stderr, "threadexit code : %u, ID : %u\n", dbginfo->dwExitCode, dbgevent.dwThreadId);
|
||||
ContinueDebugEvent(dbgevent.dwProcessId, dbgevent.dwThreadId, DBG_CONTINUE);
|
||||
} break; */
|
||||
case LOAD_DLL_DEBUG_EVENT:
|
||||
{
|
||||
LOAD_DLL_DEBUG_INFO *dbginfo = &dbgevent.u.LoadDll;
|
||||
/* if (dbginfo->lpImageName) {
|
||||
void* lpImageNameStr = NULL;
|
||||
ReadProcessMemory(proinfo->hProcess, dbginfo->lpImageName, &lpImageNameStr, sizeof(lpImageNameStr), NULL);
|
||||
fprintf(stderr, (dbginfo->fUnicode ? "loadDLLevent %S basedlladdr : 0x%p, ID : %u\n"
|
||||
: "loadDLLevent %s basedlladdr : 0x%p, ID : %u\n"), lpImageNameStr, dbginfo->lpBaseOfDll, dbgevent.dwThreadId);
|
||||
}*/
|
||||
// we have the responsibility to cleanup the handle of DLL file :
|
||||
if (dbginfo->hFile)
|
||||
CloseHandle(dbginfo->hFile);
|
||||
ContinueDebugEvent(dbgevent.dwProcessId, dbgevent.dwThreadId, DBG_CONTINUE);
|
||||
}
|
||||
break;
|
||||
case EXCEPTION_DEBUG_EVENT:
|
||||
{
|
||||
EXCEPTION_DEBUG_INFO *dbginfo = &dbgevent.u.Exception;
|
||||
// EXCEPTION_ACCESS_VIOLATION
|
||||
fprintf(stderr, "Exception code : 0x%08X, ID : %u, Address : 0x%p\n",
|
||||
dbginfo->ExceptionRecord.ExceptionCode, dbgevent.dwThreadId,
|
||||
dbginfo->ExceptionRecord.ExceptionAddress);
|
||||
// EXCEPTION_BREAKPOINT 0x80000003
|
||||
if (EXCEPTION_BREAKPOINT == dbginfo->ExceptionRecord.ExceptionCode)
|
||||
{
|
||||
// we check breakpoint interrupt, then
|
||||
if (dbgevent.u.Exception.ExceptionRecord.ExceptionAddress == (LPVOID)(DWORD_PTR)process->EntryPoint)
|
||||
{
|
||||
SuspendThread(proinfo->hThread);
|
||||
// put back the instruction :
|
||||
WriteProcessMemory(proinfo->hProcess, process->EntryPoint, instrcache, sizeof(instrcache), NULL);
|
||||
FlushInstructionCache(proinfo->hProcess, process->EntryPoint, sizeof(instrcache));
|
||||
// put back the eip :
|
||||
CONTEXT threadctx = {
|
||||
CONTEXT_CONTROL,
|
||||
};
|
||||
if (GetThreadContext(proinfo->hThread, &threadctx))
|
||||
{ // Wow64GetThreadContext
|
||||
fprintf(stderr, "EIP at 0x%p to 0x%p\n", (void *)threadctx.RegIP, process->EntryPoint);
|
||||
threadctx.RegIP = (DWORD)(DWORD_PTR)process->EntryPoint; // X86 only ??
|
||||
SetThreadContext(proinfo->hThread, &threadctx);
|
||||
}
|
||||
}
|
||||
ContinueDebugEvent(dbgevent.dwProcessId, dbgevent.dwThreadId, DBG_CONTINUE);
|
||||
}
|
||||
else
|
||||
{
|
||||
switch (dbginfo->ExceptionRecord.ExceptionCode)
|
||||
{
|
||||
case EXCEPTION_ACCESS_VIOLATION:
|
||||
fprintf(stderr, "error : EXCEPTION_ACCESS_VIOLATION(chance=%u)\n", dbginfo->dwFirstChance);
|
||||
break;
|
||||
case EXCEPTION_STACK_OVERFLOW:
|
||||
fprintf(stderr, "error EXCEPTION_STACK_OVERFLOW(chance=%u)\n", dbginfo->dwFirstChance);
|
||||
break;
|
||||
case EXCEPTION_ARRAY_BOUNDS_EXCEEDED:
|
||||
case EXCEPTION_DATATYPE_MISALIGNMENT:
|
||||
case EXCEPTION_FLT_DENORMAL_OPERAND:
|
||||
case EXCEPTION_FLT_DIVIDE_BY_ZERO:
|
||||
case EXCEPTION_FLT_INEXACT_RESULT:
|
||||
case EXCEPTION_FLT_INVALID_OPERATION:
|
||||
case EXCEPTION_FLT_OVERFLOW:
|
||||
case EXCEPTION_FLT_STACK_CHECK:
|
||||
case EXCEPTION_FLT_UNDERFLOW:
|
||||
fprintf(stderr, "error : EXCEPTION_FLT_XXX(code=%08X)\n", dbginfo->ExceptionRecord.ExceptionCode);
|
||||
break;
|
||||
case EXCEPTION_ILLEGAL_INSTRUCTION:
|
||||
case EXCEPTION_IN_PAGE_ERROR:
|
||||
case EXCEPTION_INT_DIVIDE_BY_ZERO:
|
||||
case EXCEPTION_INT_OVERFLOW:
|
||||
case EXCEPTION_INVALID_DISPOSITION:
|
||||
case EXCEPTION_NONCONTINUABLE_EXCEPTION:
|
||||
case EXCEPTION_PRIV_INSTRUCTION:
|
||||
case EXCEPTION_SINGLE_STEP:
|
||||
fprintf(stderr, "error : exception other(code=%08X)\n", dbginfo->ExceptionRecord.ExceptionCode);
|
||||
break;
|
||||
default:
|
||||
fprintf(stderr, "error : unknown(code=%08X)\n", dbginfo->ExceptionRecord.ExceptionCode);
|
||||
break;
|
||||
}
|
||||
ContinueDebugEvent(dbgevent.dwProcessId, dbgevent.dwThreadId, DBG_EXCEPTION_NOT_HANDLED);
|
||||
fin = 1;
|
||||
}
|
||||
}
|
||||
break;
|
||||
case EXIT_PROCESS_DEBUG_EVENT:
|
||||
{
|
||||
// fprintf(stderr, "Debugging Process Exit with %u(0x%08X)!\n", dbgevent.u.ExitProcess.dwExitCode, dbgevent.u.ExitProcess.dwExitCode);
|
||||
fin = 1; // breakout !!
|
||||
ContinueDebugEvent(dbgevent.dwProcessId, dbgevent.dwThreadId, DBG_CONTINUE);
|
||||
}
|
||||
break;
|
||||
case OUTPUT_DEBUG_STRING_EVENT:
|
||||
{
|
||||
OUTPUT_DEBUG_STRING_INFO *dbginfo = (OUTPUT_DEBUG_STRING_INFO *)&dbgevent.u.DebugString;
|
||||
unsigned char *msg = (unsigned char *)dbgstrbuf;
|
||||
// read debug string from debugee process :
|
||||
ReadProcessMemory(proinfo->hProcess, dbginfo->lpDebugStringData, msg, std::min(1024, (int)dbginfo->nDebugStringLength), NULL);
|
||||
fprintf(stderr, dbginfo->fUnicode ? "%S\n" : "%s\n", msg);
|
||||
ContinueDebugEvent(dbgevent.dwProcessId, dbgevent.dwThreadId, DBG_CONTINUE);
|
||||
}
|
||||
break;
|
||||
default:
|
||||
ContinueDebugEvent(dbgevent.dwProcessId, dbgevent.dwThreadId, DBG_CONTINUE);
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (WAIT_OBJECT_0 == WaitForSingleObject(process->RcpEvent, 0))
|
||||
{
|
||||
DeleteFileMapping(process);
|
||||
// fin = 1;
|
||||
if (!bSuspendFlag)
|
||||
ResumeThread(proinfo->hThread);
|
||||
}
|
||||
else
|
||||
{
|
||||
SetLastError(ERROR_SUCCESS);
|
||||
}
|
||||
}
|
||||
HeapFree(GetProcessHeap(), 0, dbgstrbuf);
|
||||
|
||||
// DebugActiveProcessStop(proinfo->dwProcessId);
|
||||
|
||||
return (0);
|
||||
}
|
||||
|
||||
int ntleaswmain(int argc, wchar_t *wargv[])
|
||||
{
|
||||
// 0. accept only 1 instance ...
|
||||
CreateMutexA(NULL, FALSE, szRcpIntMtx);
|
||||
if (GetLastError())
|
||||
{
|
||||
return PrintErrorString(ERR_MULTIPLE_INSTANCE);
|
||||
}
|
||||
|
||||
NtleaProcess ntproc = {0};
|
||||
{
|
||||
auto process = &ntproc;
|
||||
process->dwCompOption = std::stoi(wargv[1]); // 0;
|
||||
process->dwCodePage = std::stoi(wargv[2]); // 932;
|
||||
process->dwLCID = std::stoi(wargv[3]); // 0x411;
|
||||
process->dwTimeZone = std::stoi(wargv[4]); //(DWORD)-540;
|
||||
process->dwSpApp = 100; // ntlea use this value /100 for font-ratio !
|
||||
*(LPDWORD)process->FontFaceName = 0; // copy empty
|
||||
}
|
||||
LPCWSTR pApplicationName = NULL;
|
||||
// 1. parse params and prepare helper data :
|
||||
int dbg = 0, dir = 0, qit = 0, ret = 0;
|
||||
|
||||
ret = CreateProcessBeginW(&ntproc, (pApplicationName = wargv[5]));
|
||||
lstrcpyA((LPSTR)ntproc.FontFaceName, "MS PGothic");
|
||||
|
||||
// 5. if failed create process, exit ...
|
||||
if (ret < 0)
|
||||
{
|
||||
ExitProcess(qit ? ret : PrintErrorString((NtleaErrorNo)ret));
|
||||
}
|
||||
// 6. now create process :
|
||||
PROCESS_INFORMATION proinfo = {
|
||||
NULL,
|
||||
NULL,
|
||||
};
|
||||
STARTUPINFOW stinfo = {
|
||||
sizeof(STARTUPINFOW),
|
||||
};
|
||||
DWORD dwflags = dbg ? (DEBUG_ONLY_THIS_PROCESS) : (CREATE_SUSPENDED);
|
||||
if (!CreateProcessW(pApplicationName, NULL, NULL, NULL, 0, dwflags, NULL, NULL, &stinfo, &proinfo))
|
||||
{
|
||||
ExitProcess((UINT)-1); // exit !!
|
||||
}
|
||||
if (dir)
|
||||
ResetWorkingDirectory(proinfo.hProcess); //
|
||||
// 7. hook process :
|
||||
ret = (dbg ? CreateProcessEndExt : CreateProcessEnd)(&ntproc, &proinfo, FALSE);
|
||||
// 8. exit and free :
|
||||
CloseHandle(proinfo.hThread);
|
||||
if (ret < 0)
|
||||
{
|
||||
TerminateProcess(proinfo.hProcess, (UINT)ret); // exit !!
|
||||
ExitProcess(qit ? ret : PrintErrorString((NtleaErrorNo)ret));
|
||||
}
|
||||
else
|
||||
{
|
||||
CloseHandle(proinfo.hProcess);
|
||||
}
|
||||
// --------------
|
||||
ExitProcess(0); // explicit exit process ...
|
||||
}
|
||||
|
||||
NtleaErrorNo PrintErrorString(NtleaErrorNo errnum)
|
||||
{
|
||||
char const *errdesc = "<err_uknown>!";
|
||||
switch (errnum)
|
||||
{
|
||||
case ERR_PE_FORMAT_INVALID:
|
||||
errdesc = "Err: NTLEAS detect that the PE Machine could not support.";
|
||||
break;
|
||||
case ERR_MULTIPLE_INSTANCE:
|
||||
errdesc = "Err: NTLEAS could not startup two instances at one time.";
|
||||
break;
|
||||
case ERR_EXECUTABLE_MISSING:
|
||||
errdesc = "Err: NTLEAS could not find or open specified PE file.";
|
||||
break;
|
||||
case ERR_EXECUTABLE_INVALID:
|
||||
errdesc = "Err: NTLEAS detect that the given is an invalid PE file.";
|
||||
break;
|
||||
case ERR_PROCESS_CREATE_FAILED:
|
||||
errdesc = "Err: NTLEAS could not create specified process of Exe.";
|
||||
break;
|
||||
case ERR_NTLEA_DLL_MISSING:
|
||||
errdesc = "Err: NTLEAS could not find inject ntleai.dll.";
|
||||
break;
|
||||
case ERR_FAILED_ALLOCATE_MEM:
|
||||
errdesc = "Err: NTLEAS was failed to virtual allocate memory.";
|
||||
break;
|
||||
case ERR_HOOKPROCESS_MISSING:
|
||||
errdesc = "Err: NTLEAS may be lost connection with hook process.";
|
||||
break;
|
||||
case ERR_FAILED_QUERY_PROCESS:
|
||||
errdesc = "Err: NTLEAS failed query process information.";
|
||||
break;
|
||||
}
|
||||
MessageBoxA(GetForegroundWindow(), errdesc, szCaption, MB_OK);
|
||||
|
||||
return errnum;
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user